LiveActive security incident?Get immediate response
CVE Record

CVE-2021-42912: FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability.

FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool, bypassing the IP address field, and concatenating OS commands with a semicolon.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This issue lets a logged-in user on a FiberHome AN5506-04-F GPON ONU run operating-system commands through the device’s ping diagnostic function. The command runs as root, so compromise of an administrator account or exposed management interface could become full device control.

Executive priority

Treat as high priority for environments using this FiberHome ONU model, especially telecom, ISP, and managed broadband deployments. The issue requires login, but successful abuse can grant root-level device control.

Technical view

CVE-2021-42912 is an authenticated OS command injection in FiberHome ONU GPON AN5506-04-F RP2617. The CVE description says the ping diagnostic IP-address field can be bypassed to concatenate OS commands, which then execute as root. No CVSS score, CWE mapping, or vendor fix is included in the provided sources.

Likely exposure

Exposure is most likely where FiberHome AN5506-04-F devices running RP2617 are deployed and their administrative interface is reachable by untrusted users, shared networks, or the internet. The provided CVE affected-product metadata is incomplete.

Exploitation context

The provided sources require the attacker to be logged in. There is no KEV listing and no cited evidence here of active exploitation. The main risk is post-authentication escalation to root command execution on a network access device.

Researcher notes

The record is sparse: severity, CVSS, CWE, CPE, and official patch details are absent. The strongest supported facts are the affected model/firmware named in the title, authenticated ping diagnostic injection, and root execution impact.

Mitigation direction

  • Check FiberHome guidance for fixed firmware or official mitigations.
  • Restrict device administration to trusted management networks or VPN access.
  • Remove internet exposure from ONU management interfaces where possible.
  • Replace default or shared credentials with unique administrator passwords.
  • Monitor configuration changes and diagnostic-tool use on affected devices.

Validation and detection

  • Inventory FiberHome AN5506-04-F devices and record firmware versions.
  • Confirm whether any devices run RP2617 or related unverified builds.
  • Review management-interface exposure from internal and external network paths.
  • Check administrative accounts for default, shared, or stale credentials.
  • Review logs for unusual diagnostic actions or unexpected configuration changes.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-42912 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.